Adversarial Robustness of Complex-Valued Graph Attention Beamformers: A Gradient Efficiency Study

Abstract

Graph neural network (GNN) based beamformers have demonstrated near-optimal performance for multi-user MISO systems, yet their security under adversarial channel perturbations remains unexplored. We study the adversarial robustness of a complex-valued Graph Attention Network (GAT) beamformer trained via unsupervised Lagrangian optimization on the DeepMIMO O1 28 GHz dataset (250,000 users, 64- antenna ULA, K=8 users). A complex-domain Fast Gradient Sign Method (FGSM) attack on channel state information (CSI) achieves 65.2% sum-rate degradation at perturbation strength ε=0.05 — within the range of realistic CSI estimation error. Comparative evaluation against Zero-Forcing and Maximum Ratio Transmission beamformers reveals that vulnerability is not determined by gradient magnitude: Zero-Forcing exhibits a 7.6× larger gradient norm yet suffers only 18.3% degradation. We introduce a gradient efficiency metric that isolates the cause: the GNN’s learned representation creates gradient directions highly aligned with performance-critical channel features, a property absent in closed-form beamformers. Critically, mathematical ver ification confirms the architecture satisfies conjugate equivariance f(e jϕH) = e −jϕf(H) with score 0.000, demonstrating that correct physical symmetry does not imply adversarial robustness. Index Terms—adversarial robustness, beamforming, graph at tention network, complex-valued neural networks, phys